Wireshark 3.2.3 Released: Mac Users Pay Attention Please, (Sat, Apr 11th)
Wireshark version 3.2.3 was released.
Continue reading Wireshark 3.2.3 Released: Mac Users Pay Attention Please, (Sat, Apr 11th)
Author Archives: SANS Internet Storm Center, InfoCON: green
Critical Vuln in vCenter vmdir (CVE-2020-3952), (Fri, Apr 10th)
On April 9, VMware published VMSA-2020-0006, a security advisory for a critical vulnerability in vCenter Server that received the maximum CVSSv3 score of 10.0. The vulnerablity, %%cve:2020-3952%% , involves a sensitive information disclosure flaw in the VMware Directory Service (vmdir) which is included with VMware vCenter. Per the advisory, vmdir does not implement proper access controls, which could allow a malicious attacker with network access to obtain sensitive information. This likely can allow the attacker to compromise other services which rely on vmdir for authentication.
Continue reading Critical Vuln in vCenter vmdir (CVE-2020-3952), (Fri, Apr 10th)
PowerShell Sample Extracting Payload From SSL, (Fri, Apr 10th)
Another diary, another technique to fetch a malicious payload and execute it on the victim host. I spotted this piece of Powershell code this morning while reviewing my hunting results. It implements a very interesting technique. As usual, all the code snippets below have been beautified.
Continue reading PowerShell Sample Extracting Payload From SSL, (Fri, Apr 10th)
ISC Stormcast For Friday, April 10th 2020 https://isc.sans.edu/podcastdetail.html?id=6948, (Fri, Apr 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 10th 2020 https://isc.sans.edu/podcastdetail.html?id=6948, (Fri, Apr 10th)
Performing deception to OS Fingerprint (Part 1: nmap), (Sat, Mar 28th)
How can you know which operating system is running on a specific remote host? The technique to answer this question corresponds to the fingerprinting of the operating system and is executed by sending a specific set of packages to the remote host and see how it behaves. Each operating system responds differently, which allows it to be identified.
Continue reading Performing deception to OS Fingerprint (Part 1: nmap), (Sat, Mar 28th)
ISC Stormcast For Thursday, April 9th 2020 https://isc.sans.edu/podcastdetail.html?id=6946, (Thu, Apr 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 9th 2020 https://isc.sans.edu/podcastdetail.html?id=6946, (Thu, Apr 9th)
ISC Stormcast For Wednesday, April 8th 2020 https://isc.sans.edu/podcastdetail.html?id=6944, (Wed, Apr 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 8th 2020 https://isc.sans.edu/podcastdetail.html?id=6944, (Wed, Apr 8th)
German malspam pushes ZLoader malware, (Wed, Apr 8th)
Increase in RDP Scanning, (Tue, Apr 7th)
ISC Stormcast For Tuesday, April 7th 2020 https://isc.sans.edu/podcastdetail.html?id=6942, (Tue, Apr 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 7th 2020 https://isc.sans.edu/podcastdetail.html?id=6942, (Tue, Apr 7th)